Floyd Hoare Logic

1
Floyd Hoare Logic
2
Semantics

• A programming language specification consists of
  a syntactic description and a semantic
  description.
• Syntactic descriptionsymbols we can use in a
  language
• Semantic Description what phrases in a
  programming language mean.
• Semantics may be given as
• Denotational
• Axiomatic
• Operational
• We concentrate on axiomatic descriptions the
  meaning is defined by a logical calculus called
  program logic which provides a tool for the
  derivation of programs and assertions of the form
  Q p R

3
Example

• Read in 2 integers and output their product
  divided by their sum. You are guaranteed that
  there are 2 integer values in the input stream.
• Precondition Input stream contains two
  integer values
• Postcondition Product / Sum is output
• Q p R states that a program p. once started
  in a state satisfying Q will lead to a
  situation characterised byR
• Q may also be written as the weakest
  precondition of p tp achieve postcondition R
  i.e. wp(p, R)

4

• Wp(S, R) represents the set of all states such
  that execution of S beginning in any one of them
  is guaranteed to terminate in a finite amount of
  time satisfying R.
• Examples
• wp (i i 1, i lt 1)
• S if xgty then z x else z y, R z max(x,y)
• calculate wp(S,R)
• Let S be as above and R zy, calculate wp(S,R)
• S if xgty then z x else z y,R z y-1
• calculate wp(S,R)
• Let S be as above, R z y1

5

• Command S is usually designed to establish the
  truth of a postcondition R. We may not be
  interested in wp(S,R). If we can find a stronger
  precondition Q that represents a subset of the
  set wp(S,R)and can show Q gt wp(S,R) then we are
  content with Q as the postcondition.
• When we write Q p R we denote Total
  Correctness
• Q p R denotes partial correctness.

6
Some properties of wp

• Law of excluded miracle wp(S,F) F
• Distributivity of conjunction wp(S,Q) ?wp(S,R)
  wp(S,Q ?R)
• Law of monotonicity if Q gt R then wp(S,Q) gt
  wp(S,R)
• Distributivity of disjunction wp(S,Q) ?wp(S,R)
  gt wp(S,Q ? R)
• Nondeterministic
• Execution of a command is nondeterministic if it
  need not always be exactly the same each time it
  is begun in the same state
• e.g. x 4 x 14 x x1 ?

7
Exercises

• Determine
• wp (i i 1, i gt0)
• wp(i i 2 j j -2, i j 0)
• wp(i i 1j j -1, i j 0)
• wp(z zj i i -1, z ji c)
• wp(ai 1, ai aj)
• wp(aai i, aii)

8
Skip Abort

• Skip
• Execution of the skip command does nothing.
• It is equivalent to the empty command
• It is the identity transformer
• wp(skip, R) R
• Abort
• wp(abort, R) False
• Abort should never be executed as it may only be
  executed in a state satisfying False.

9
Sequential Composition

• A way of composing larger programs from smaller
  segments
• If s1 and S2 are commands then s1s2 is a new
  command
• wp (s1s2, R) wp(s1, wp(s2, R))
• Assignment
• x e
• x is a simple variable, e is an expression and
  the types of x and e are the same
• wp(x e, R) domain(e) cand Rex
• Domain(e) is a predicate that describes the set
  of all states in which e may be evaluated i.e. is
  well defined.
• Usually we write wp(x e, R) Rex

10
Examples

• wp(x5, x 5)
• wp(x5, x !5)
• wp(xx1, x lt10)
• wp(x xx, x4 10)
• wp(xa/b, p(x))
• wp(xbi, xbi) for b, an array with indexes
  0 ..100

11
Multiple Assignment

• Multiple assignment has the form
• x1, x2, x3, , xn e1, e2, e3, , en
• where xi are distinct simple variables and ei
  are expressions.
• Definition
• wp(x1, x2, x3, , xn e1, e2, e3, , en, R)
• domain(e1, e2, e3, , en) cand R e1, e2, e3,
  , en x1, x2, x3, , xn
• Examples x,y y, x
• x,y,z y,z,x
• wp(z,yzx, y-1, ygt0 ? zxy c)

12

• Execution of an expression may change only the
  variables indicated and evaluation of an
  expression may change no variables.
• Thi sprohits functions with side effects and
  allows us to consider expressions as conventional
  mathematical entities I.e. we can use
  associativity, commutativity of addition etc.
• Example Swapping two variables
• wp(tx xy yt, x X ? y Y

13
The if statement

• If B1 ? S1
• B2 ? S2
• Bn ? Sn
• fi
• Each Bi ?Si is a guarded command and each Si may
  be any command e.g. skip, about, sequential
  composition etc.
• If any guard Bi is not well defined in the state
  in which execution begins, abortion may occur.
  This is because nothing is assumed by the order
  of evaluation of the guards.
• At least one guard must be true to avoid
  abortion.
• If at least one guard Bi is true, then 1 guarded
  command Bi ?Si is chosen and Si is executed.

14
Wp (If, R)

• Wp (If, R)
• domain(BB) ? BB ? (B1? wp(S1, R)) ? ? (Bn?
  wp(Sn, R))
• where BB B1 ? B2 ? ... ? Bn
• ?
• wp(If, R) (?i 1 lt i lt n Bi ) ? (?i 1
  lt i lt n Bi ? wp(Si, R))
• Example A ? (if x gt0 ? z x
• x lt 0 ? z -x )
• wp(A, z abs(x)) True

15
Example

• T ? (xgt0) ? (x lt 0)
• if x gt 0
• x abs(x)
• zx
• z abs(x)
• x gt 0
• - x abs(x)
• z - x
• z abs(x)
• fi
• (x gt0 ? x lt 0) ? (x gt0 ? z abs(x)) ? (x
  lt0 ? z abs(x))
• ? z abs(x)

16
Exercises

• Complete and Simplify
• 1. wp (S, agt0 ? b gt0) where
• S if a gt b ? a a-b
• b gt a? b b-a
• fi
• 2. wp( S, x lt y) where
• S if x gt y ? x,y y,x
• xlty ? skip
• fi

17
The Iterative Command

• Do B ? S oD
• where B ? S is a guarded command. This is
  equivalent to a while loop.
• Do (xgt0) ? x x-1 oD
• ? while (xgt0) x x-1
• We can generalize in the guarded command language
  to
• Do B1 ? S1
• B2 ? S2
• Bn ? Sn
• oD where ngt0, and Bi ? Si is a guarded
  command.
• Note Non Determinism is allowed.

18

• Let BB B1 ? B2 ? ? Bn
• H0(R) ?BB ? R
• Represents the set of states in which execution
  of DO terminates in 0 iterations with R true, as
  the guards are initially false
• wp(DO,R) ?k 0ltk Hk(R)
• Represents the set of states in which execution
  of DO terminates in a bounded number of
  iterations with R true.
• Example What does the following calculate? How
  can we prove it?
• i,s 1, b0
• Do i ltgt 11 ? i,s i1, s bi OD
• R s ? k 0ltklt11bk)

19

• Invariant P Predicate that is true throughout
  the program
• Guard Bi, BB
• True on entry into the loop
• May be true or false at the exit point of the
  loop gt re-evaluate guard
• The guard is always false after the loop
  terminates
• Postcondition R The postcondition should imply
  the Invariant and the negation of the guard i.e.
  P ? ?BB gt R
• PreconditionQ Should imply the Invariant with
  initialisations.

20
Loop Template

• Q ? P
• Do BB
• P ? BB
• Loop Body
• P
• Od
• P ? ?BB ? R

21
Program Verification

• Given a precondition, a postcondition and some
  code verify that the code when executed in a
  state satisfying the given precondition achieves
  the given postcondition.
• Q Array b has values
• i,s 1,b0
• Do i ltgt N
• i,s i 1, sbi
• Od
• R s ? k 0ltklt11bk)

22
Loop Termination

• To show that a loop terminates we introduce an
  integer function, t. where t is a function of the
  program variables i.e. an upper bound on the
  number of iterations still to be performed.
• t is called the variant function and it is a
  measure of the amount of work yet to be completed
  by the loop.
• Each iteration of the loop decreases t by at
  least one
• As long as execution of the loop has not
  terminated then t is bounded below by 0. Hence
  the loop must terminate.
• In our last example t 11-i

23
Checklist for loops

• Show that P is true before the execution of a
  loop begins
• Show that P ? ?BB ? R i.e. when the loop
  terminates the desired result is true.
• Show that P ? Bi Si P 1ltiltn i.e. execution
  of each guarded command terminates with P true so
  that P is an invariant of the loop.
• Show that P ? BB ? (t gt0) so that the bound
  function i.e. the amount of work yet to be done
  is bounded from below as long as the loop has not
  terminated.
• Show that P ? Bi t1 tSi tltt1 for 1 ltiltn
  so that each loop iteration is guaranteed to
  decrease the bound function. In general t can
  only provide an upper bound on the number of
  iterations to be performed. Hence, it is called
  the bound function or the variant function.